Financial Statement Audits and Data Breaches.

This article investigates whether financial statement audits for public companies, which include testing internal controls over information technology (IT) systems material to financial reporting, also help prevent data breaches. Using exogenous variations from Public Company Accounting Oversight Board (PCAOB) inspections identifying IT-related audit deficiencies and auditors’ cross-client learning from data breach experiences, the study finds that clients of auditors who improve IT control testing are significantly less likely to experience data breaches. Interviews with accounting firm partners and industry professionals reveal two key mechanisms: auditors provide relevant information about interconnected financial and nonfinancial data systems, and they incentivize firms to strengthen internal controls. The findings suggest that enhancing accounting information systems through auditing can positively impact broader organizational data security, although the study acknowledges limitations related to unobserved internal control procedures and the focus on auditing’s role without claiming it as the sole or best method for breach prevention.